Cellebrite Apple Advanced Forensics (CAAF)

Operating systems leave complex traces in both allocated space and unallocated free space on a data carrier. This three-day training will cover, among other things, the more complex concepts, such as recovery points found in an iOS and macOS investigation. The Cellebrite Apple Advanced Forensics training is led by an instructor who provides comprehensive explanations of the subject matter, but the participants also do many practical exercises themselves.

Who is this training for?
This training is for advanced digital investigators with good knowledge of Computer Forensics and extensive knowledge of Mac forensics obtained in e.g. the Cellebrite Apple Intermediate Forensics training.

What do you learn during the training?

• Distinguishing between handling deleted APFS and HFS+ files.
• Recovering artefacts in both allocated and unallocated spaces.
• Recognising hardware and software RAID systems.
• Understanding advanced iOS analytics practices.
• Using log files to reconstruct usage history and create timelines.
• Understanding and exploring Extended Attributes, Spotlight evidence and file sharing artefacts.
• Identifying and using passwords stored on macOS.